0262fbda1aae755a56543960e27bc549604713ccc00ce5054514d9ff10cbcd91

Analysis

max time kernel
10s
max time network
12s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
06/07/2026, 01:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

Reason

Machine shutdown

General

Target
Launcher.exe
Size 298KB
Sample260706-b6579scy2l
SHA256 0262fbda1aae755a56543960e27bc549604713ccc00ce5054514d9ff10cbcd91
MD5 5cbe2861c0fe178d00a22a3ed2484b66
SHA1 5228089a9fe94f00a2012e54db95c3e957853c0e
SHA512 b297df98c0d18d9fb04af5c9890c7b3d85b42064e718948f51147dc7c0da8578fc73ae87ac6e2de9a2586aa339592ef88624285a6ed66caabd29d760b8bb6432
SSDEEP 6144:17I4BO7sHaT3UYyQGxneNT2hc81qqLZaRX4j/zAGEDLm/mvYa:ZRWgqqaRoj/zADLm/ha
TLSH
T1D9548E16E79511FEE577C67CCD824902EB727C4547A0EACF13A049A62F236E09E3E712
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery exploit trojan

Malware Config

Signatures

Modify Registry: Disable Windows Driver Blocklist 2 TTPs 1 IoCs

Disable Windows Driver Blocklist via Registry.

defense_evasion

Modify Registry

T1112

Impair Defenses

T1562

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\CI\Config\VulnerableDriverBlocklistEnable = "0"	mscfg_332f930e.exe

Possible privilege escalation attempt 18 IoCs

exploit

pid	Process
2984	takeown.exe
1884	takeown.exe
3404	icacls.exe
2584	icacls.exe
3756	takeown.exe
5884	icacls.exe
3608	icacls.exe
5964	icacls.exe
2796	takeown.exe
3820	icacls.exe
3976	icacls.exe
6088	takeown.exe
4316	takeown.exe
1628	icacls.exe
4232	takeown.exe
5192	takeown.exe
1396	takeown.exe
5588	icacls.exe

Executes dropped EXE 1 IoCs

pid	Process
4224	mscfg_332f930e.exe

Modifies file permissions 1 TTPs 18 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
2796	takeown.exe
1396	takeown.exe
1628	icacls.exe
2984	takeown.exe
3820	icacls.exe
6088	takeown.exe
5588	icacls.exe
1884	takeown.exe
5884	icacls.exe
3608	icacls.exe
5964	icacls.exe
5192	takeown.exe
4316	takeown.exe
2584	icacls.exe
4232	takeown.exe
3404	icacls.exe
3976	icacls.exe
3756	takeown.exe

Windows security modification 2 TTPs 1 IoCs

defense_evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features	mscfg_332f930e.exe

File and Directory Permissions Modification: Windows File and Directory Permissions Modification 1 TTPs
defense_evasion

Windows File and Directory Permissions Modification
T1222.001

Modifies data under HKEY_USERS 4 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = 99ebff004cc2ff000091f8000078d4000067c000003e9200001a6800f7630c00	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	2984	takeown.exe
Token: SeShutdownPrivilege	4224	mscfg_332f930e.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2776	LogonUI.exe

Suspicious use of WriteProcessMemory 19 IoCs

description	pid	Process	procid_target
PID 1392 wrote to memory of 4224	1392	Launcher.exe	89
PID 4224 wrote to memory of 2984	4224	mscfg_332f930e.exe	91
PID 4224 wrote to memory of 5964	4224	mscfg_332f930e.exe	93
PID 4224 wrote to memory of 2796	4224	mscfg_332f930e.exe	95
PID 4224 wrote to memory of 3820	4224	mscfg_332f930e.exe	97
PID 4224 wrote to memory of 5192	4224	mscfg_332f930e.exe	99
PID 4224 wrote to memory of 3404	4224	mscfg_332f930e.exe	101
PID 4224 wrote to memory of 1396	4224	mscfg_332f930e.exe	103
PID 4224 wrote to memory of 3976	4224	mscfg_332f930e.exe	105
PID 4224 wrote to memory of 6088	4224	mscfg_332f930e.exe	107
PID 4224 wrote to memory of 5588	4224	mscfg_332f930e.exe	109
PID 4224 wrote to memory of 4316	4224	mscfg_332f930e.exe	111
PID 4224 wrote to memory of 2584	4224	mscfg_332f930e.exe	113
PID 4224 wrote to memory of 3756	4224	mscfg_332f930e.exe	115
PID 4224 wrote to memory of 1628	4224	mscfg_332f930e.exe	117
PID 4224 wrote to memory of 1884	4224	mscfg_332f930e.exe	119
PID 4224 wrote to memory of 5884	4224	mscfg_332f930e.exe	121
PID 4224 wrote to memory of 4232	4224	mscfg_332f930e.exe	123
PID 4224 wrote to memory of 3608	4224	mscfg_332f930e.exe	125

C:\Users\Admin\AppData\Local\Temp\Launcher.exe
"C:\Users\Admin\AppData\Local\Temp\Launcher.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1392
- C:\Users\Admin\AppData\Local\Temp\mscfg_332f930e.exe
  "C:\Users\Admin\AppData\Local\Temp\mscfg_332f930e.exe"
  2⤵
  - Modify Registry: Disable Windows Driver Blocklist
  - Executes dropped EXE
  - Windows security modification
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4224
- - C:\Windows\SYSTEM32\takeown.exe
    takeown /f "C:\Windows\System32\CodeIntegrity\CiPolicies\Active" /r /d y
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    - Suspicious use of AdjustPrivilegeToken
    PID:2984
- - C:\Windows\SYSTEM32\icacls.exe
    icacls "C:\Windows\System32\CodeIntegrity\CiPolicies\Active" /grant Administrators:F /t /c
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:5964
- - C:\Windows\SYSTEM32\takeown.exe
    takeown /f "C:\Windows\System32\CodeIntegrity\CiPolicies\Active\{0283AC0F-FFF1-49AE-ADA1-8A933130CAD6}.cip"
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:2796
- - C:\Windows\SYSTEM32\icacls.exe
    icacls "C:\Windows\System32\CodeIntegrity\CiPolicies\Active\{0283AC0F-FFF1-49AE-ADA1-8A933130CAD6}.cip" /grant Administrators:F
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:3820
- - C:\Windows\SYSTEM32\takeown.exe
    takeown /f "C:\Windows\System32\CodeIntegrity\CiPolicies\Active\{0939ED82-BFD5-4D32-B58E-D31D3C49715A}.cip"
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:5192
- - C:\Windows\SYSTEM32\icacls.exe
    icacls "C:\Windows\System32\CodeIntegrity\CiPolicies\Active\{0939ED82-BFD5-4D32-B58E-D31D3C49715A}.cip" /grant Administrators:F
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:3404
- - C:\Windows\SYSTEM32\takeown.exe
    takeown /f "C:\Windows\System32\CodeIntegrity\CiPolicies\Active\{1283AC0F-FFF1-49AE-ADA1-8A933130CAD6}.cip"
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:1396
- - C:\Windows\SYSTEM32\icacls.exe
    icacls "C:\Windows\System32\CodeIntegrity\CiPolicies\Active\{1283AC0F-FFF1-49AE-ADA1-8A933130CAD6}.cip" /grant Administrators:F
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:3976
- - C:\Windows\SYSTEM32\takeown.exe
    takeown /f "C:\Windows\System32\CodeIntegrity\CiPolicies\Active\{1678656C-05EF-481F-BC5B-EBD8C991502D}.cip"
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:6088
- - C:\Windows\SYSTEM32\icacls.exe
    icacls "C:\Windows\System32\CodeIntegrity\CiPolicies\Active\{1678656C-05EF-481F-BC5B-EBD8C991502D}.cip" /grant Administrators:F
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:5588
- - C:\Windows\SYSTEM32\takeown.exe
    takeown /f "C:\Windows\System32\CodeIntegrity\CiPolicies\Active\{1939ED82-BFD5-4D32-B58E-D31D3C49715A}.cip"
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:4316
- - C:\Windows\SYSTEM32\icacls.exe
    icacls "C:\Windows\System32\CodeIntegrity\CiPolicies\Active\{1939ED82-BFD5-4D32-B58E-D31D3C49715A}.cip" /grant Administrators:F
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:2584
- - C:\Windows\SYSTEM32\takeown.exe
    takeown /f "C:\Windows\System32\CodeIntegrity\CiPolicies\Active\{2678656C-05EF-481F-BC5B-EBD8C991502D}.cip"
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:3756
- - C:\Windows\SYSTEM32\icacls.exe
    icacls "C:\Windows\System32\CodeIntegrity\CiPolicies\Active\{2678656C-05EF-481F-BC5B-EBD8C991502D}.cip" /grant Administrators:F
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:1628
- - C:\Windows\SYSTEM32\takeown.exe
    takeown /f "C:\Windows\System32\CodeIntegrity\CiPolicies\Active\{784C4414-79F4-4C32-A6A5-F0FB42A51D0D}.cip"
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:1884
- - C:\Windows\SYSTEM32\icacls.exe
    icacls "C:\Windows\System32\CodeIntegrity\CiPolicies\Active\{784C4414-79F4-4C32-A6A5-F0FB42A51D0D}.cip" /grant Administrators:F
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:5884
- - C:\Windows\SYSTEM32\takeown.exe
    takeown /f "C:\Windows\System32\CodeIntegrity\CiPolicies\Active\{A072029F-588B-4B5E-B7F9-05AAD67DF687}.cip"
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:4232
- - C:\Windows\SYSTEM32\icacls.exe
    icacls "C:\Windows\System32\CodeIntegrity\CiPolicies\Active\{A072029F-588B-4B5E-B7F9-05AAD67DF687}.cip" /grant Administrators:F
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:3608

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa3a1d055 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:2776

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k CameraMonitor
1⤵
PID:2804

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Windows File and Directory Permissions Modification

T1222.001

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

mscfg_332f930e.exe

Path C:\Users\Admin\AppData\Local\Temp\mscfg_332f930e.exe
Size 298KB
SHA256 0262fbda1aae755a56543960e27bc549604713ccc00ce5054514d9ff10cbcd91
MD5 5cbe2861c0fe178d00a22a3ed2484b66
SHA1 5228089a9fe94f00a2012e54db95c3e957853c0e
SHA512 b297df98c0d18d9fb04af5c9890c7b3d85b42064e718948f51147dc7c0da8578fc73ae87ac6e2de9a2586aa339592ef88624285a6ed66caabd29d760b8bb6432
SSDEEP 6144:17I4BO7sHaT3UYyQGxneNT2hc81qqLZaRX4j/zAGEDLm/mvYa:ZRWgqqaRoj/zADLm/ha
TLSH
T1D9548E16E79511FEE577C67CCD824902EB727C4547A0EACF13A049A62F236E09E3E712
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads